# VTIL-Core

> C++20 core of the VTIL (Virtual-machine Translation Intermediate Language) project, an intermediate language and optimizing compiler that the README describes as built for binary de-obfuscation and de-virtualization. Unlike LLVM IR, VTIL keeps the native stack, physical registers and non-SSA form, so code from register or stack machines can be lifted into it, native instructions can stay inline, and code can be emitted back at any virtual address. The library provides the IL with routines, basic blocks and serialization, a symbolic expression engine and simplifier, optimizer passes such as dead-code elimination, propagation and stack pinning, and Capstone/Keystone-based AMD64 and ARM64 disassembly and assembly helpers.

- Type: Tool
- Targets: Binary
- Category: Binary analysis libraries
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-19
- Original resource: <https://github.com/vtil-project/VTIL-Core>
- Primary source: <https://github.com/vtil-project/VTIL-Core/blob/9ebee8e890a3a8923cc41f07821f740910e7c9b2/README.md>
- Catalog page: <https://awesomerea.org/resources/vtil-core/>
- Record JSON: <https://awesomerea.org/resources/vtil-core/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/vtil-core/index.md)

## Requirements & limits

- No releases or tags; the README says the repository is incomplete because the initial release is not done, and further documentation is still to come. The reviewed master commit (2026-07-27) only edits the README; the preceding code commits date from 2026-04-04 and 2026-04-05.
- Build with CMake 3.16+ and a C++20 compiler: generate a Visual Studio solution on Windows, or use Ninja on Linux and macOS, where Apple Silicon builds need -DCMAKE_OSX_ARCHITECTURES=x86_64. CMake fetches Capstone and Keystone at pinned commits, and CI builds on Windows Server 2022, Ubuntu 24.04 and macOS 14.
- This is a library for analyzing virtualized or obfuscated code: the user supplies a lifter that translates the code under analysis into VTIL routines, which can then be optimized, inspected or re-emitted. The reviewed tree contains no lifter for a particular virtual machine or protector. Its Sample Routines folder holds 2020 .vtil test routines next to the small C test functions they correspond to, which commit messages describe as VMProtect tests.
- BSD-3-Clause license. The fetched dependencies keep their own licenses: Capstone's BSD-style license, and Keystone's GPL-2.0 with a FOSS license exception, which matters when distributing builds.

## Primary sources

1. <https://github.com/vtil-project/VTIL-Core/blob/9ebee8e890a3a8923cc41f07821f740910e7c9b2/README.md>
2. <https://github.com/vtil-project/VTIL-Core/blob/9ebee8e890a3a8923cc41f07821f740910e7c9b2/CMakeLists.txt>
3. <https://github.com/vtil-project/VTIL-Core/blob/9ebee8e890a3a8923cc41f07821f740910e7c9b2/Docs/COMPILE.md>
4. <https://github.com/vtil-project/VTIL-Core/blob/9ebee8e890a3a8923cc41f07821f740910e7c9b2/VTIL-Common/CMakeLists.txt>
5. <https://github.com/vtil-project/VTIL-Core/blob/9ebee8e890a3a8923cc41f07821f740910e7c9b2/Dependencies/capstone/CMakeLists.txt>
6. <https://github.com/vtil-project/VTIL-Core/blob/9ebee8e890a3a8923cc41f07821f740910e7c9b2/Dependencies/keystone/CMakeLists.txt>
7. <https://github.com/vtil-project/VTIL-Core/tree/9ebee8e890a3a8923cc41f07821f740910e7c9b2/VTIL-Compiler/optimizer>
8. <https://github.com/vtil-project/VTIL-Core/tree/9ebee8e890a3a8923cc41f07821f740910e7c9b2/Sample%20Routines>
9. <https://github.com/vtil-project/VTIL-Core/blob/9ebee8e890a3a8923cc41f07821f740910e7c9b2/.github/workflows/build.yml>
10. <https://github.com/vtil-project/VTIL-Core/blob/9ebee8e890a3a8923cc41f07821f740910e7c9b2/LICENSE.md>
11. <https://github.com/keystone-engine/keystone/blob/dc7932ef2b2c4a793836caec6ecab485005139d6/EXCEPTIONS-CLIENT>

## More in Native binaries

- [Frida Workbench for VSCode](https://awesomerea.org/resources/vscode-frida/index.md) · Tool
- [ghidriff](https://awesomerea.org/resources/ghidriff/index.md) · Tool
- [Ddisasm](https://awesomerea.org/resources/ddisasm/index.md) · Tool
- [PINCE](https://awesomerea.org/resources/pince/index.md) · Tool
- [uncompyle6](https://awesomerea.org/resources/uncompyle6/index.md) · Tool
- [ret-sync](https://awesomerea.org/resources/ret-sync/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.